@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/dist/esm/publish-refusals.js

@@ -0,0 +1,271 @@
+import { TableAccess } from '@teleporthq/teleport-shared';
+import { CLIENT_ONLY_NODES, isVerifiedWebhookConfig } from './api-route-generator';
+import { isAutomationWorkflow } from './automations/automations-scope';
+import { stepNameOf } from './nodes/email/message-trust';
+import { describeRefusedSend, markVisitorBoundMessageNodes, markWebhookMessageNodes, REFUSE_SEND_KEY, } from './nodes/email/outbound-message-guard';
+import { assertNoPublicRestrictedSteps, describePublicStepRefusals, findPublicRestrictedSteps, } from './public-step-guards';
+import { parameterizeAllWorkflowRawSql, parameterizeWorkflowRawSqlInterpolations, WorkflowSqlInterpolationError, } from './raw-sql-param-binding';
+import { assertWorkflowsAreSecure, CodegenSecurityError } from './security-scanner';
+import { splitIntoSegments } from './segment-splitter';
+import { buildSegmentTrust } from './segment-trust';
+import { assertServerBoundCallParameters, findBrowserBoundCallParameters, } from './server-custom-node-call';
+const ownersOf = (workflows) => [
+    ...Object.entries(workflows.workflows || {})
+        .filter(([, workflow]) => !!workflow)
+        .map(([ownerId, workflow]) => ({
+        ownerId,
+        ownerName: workflow.name || ownerId,
+        ownerKind: 'workflow',
+        graph: workflow,
+    })),
+    ...Object.entries(workflows.customNodes || {})
+        .filter(([, customNode]) => !!customNode)
+        .map(([ownerId, customNode]) => ({
+        ownerId,
+        ownerName: customNode.name || ownerId,
+        ownerKind: 'custom-node',
+        graph: customNode,
+    })),
+];
+const stepName = (owner, nodeId) => {
+    const node = (owner.graph.nodes || []).find((candidate) => candidate && candidate.id === nodeId);
+    return node ? stepNameOf(node) : nodeId;
+};
+const rawSqlRefusals = (workflows) => ownersOf(workflows).flatMap((owner) => {
+    try {
+        parameterizeWorkflowRawSqlInterpolations(owner.graph);
+        return [];
+    }
+    catch (error) {
+        if (!(error instanceof WorkflowSqlInterpolationError)) {
+            throw error;
+        }
+        return error.residualsByNode.map((residual) => ({
+            ownerId: owner.ownerId,
+            ownerKind: owner.ownerKind,
+            nodeId: residual.nodeId,
+            message: `The step "${stepName(owner, residual.nodeId)}" in "${owner.ownerName}": ${new WorkflowSqlInterpolationError([residual]).message}`,
+        }));
+    }
+});
+const customCodeRefusals = (workflows) => {
+    try {
+        assertWorkflowsAreSecure(workflows);
+        return [];
+    }
+    catch (error) {
+        if (!(error instanceof CodegenSecurityError)) {
+            throw error;
+        }
+        return error.violations.map((violation) => {
+            // A violation names the graph it is in by id, a workflow's or a custom node's.
+            const owner = ownersOf(workflows).find((candidate) => candidate.ownerId === violation.workflowId);
+            return {
+                ownerId: violation.workflowId,
+                ownerKind: owner ? owner.ownerKind : 'workflow',
+                nodeId: violation.nodeId,
+                message: `The step "${owner ? stepName(owner, violation.nodeId) : violation.nodeId}" in "${violation.workflowName || violation.workflowId}" ${violation.message}, so publishing refuses it.`,
+            };
+        });
+    }
+};
+const publicStepRefusals = (workflows, authentication) => {
+    const staffRoles = TableAccess.resolveStaffRoles(authentication);
+    return findPublicRestrictedSteps(workflows, { staffRoles }).map((refusal) => ({
+        ownerId: refusal.ownerId,
+        ownerKind: refusal.ownerKind,
+        nodeId: refusal.nodeId,
+        message: describePublicStepRefusals([refusal], staffRoles),
+    }));
+};
+/** R-N23: what the owner is told about a newsletter sign-up step anywhere else. */
+export const NEWSLETTER_SIGNUP_REFUSAL_MESSAGE = 'The newsletter sign-up step runs only when a visitor submits a form.';
+/**
+ * A `newsletter-subscribe` step outside a workflow a visitor's form submit
+ * starts: on a page load, a click, a cron, a webhook, an automation or in a
+ * custom node (which any of those may call), the address would come from
+ * somewhere else than a person typing their own (a link's parameter, a row),
+ * and the site would mail whomever it names. The editor refuses it too.
+ */
+const newsletterSignupRefusals = (workflows) => ownersOf(workflows).flatMap((owner) => {
+    const trigger = owner.ownerKind === 'workflow' ? owner.graph.trigger : null;
+    if (trigger && trigger.type === 'event-form-submitted') {
+        return [];
+    }
+    return (owner.graph.nodes || [])
+        .filter((node) => !!node && node.type === 'newsletter-subscribe')
+        .map((node) => ({
+        ownerId: owner.ownerId,
+        ownerKind: owner.ownerKind,
+        nodeId: node.id,
+        message: `The step "${stepNameOf(node)}" in "${owner.ownerName}": ${NEWSLETTER_SIGNUP_REFUSAL_MESSAGE}`,
+    }));
+});
+export class NewsletterSignupRefusalError extends Error {
+    constructor(refusals) {
+        super(refusals.map((refusal) => refusal.message).join(' '));
+        this.code = 'NEWSLETTER_SIGNUP_REFUSED';
+        // `extends Error` loses the prototype when downlevelled to ES5.
+        Object.setPrototypeOf(this, NewsletterSignupRefusalError.prototype);
+        this.name = 'NewsletterSignupRefusalError';
+    }
+}
+const assertNewsletterSignupOnFormSubmit = (workflows) => {
+    const refusals = newsletterSignupRefusals(workflows);
+    if (refusals.length > 0) {
+        throw new NewsletterSignupRefusalError(refusals);
+    }
+};
+/**
+ * The gates the plugin runs over the whole block before any code is emitted,
+ * in its order: raw SQL is bound first, so the gates after it read the SQL
+ * that ships.
+ */
+const WORKFLOW_BLOCK_GATES = [
+    { check: 'raw-sql', assert: parameterizeAllWorkflowRawSql, collect: rawSqlRefusals },
+    { check: 'custom-code', assert: assertWorkflowsAreSecure, collect: customCodeRefusals },
+    { check: 'public-steps', assert: assertNoPublicRestrictedSteps, collect: publicStepRefusals },
+    {
+        check: 'newsletter-sign-up',
+        assert: assertNewsletterSignupOnFormSubmit,
+        collect: newsletterSignupRefusals,
+    },
+];
+/** The plugin's gates over the workflow block, before any code is emitted: throws the first refusal. */
+export const assertWorkflowPublishGates = (workflows, authentication) => {
+    if (!workflows) {
+        return;
+    }
+    for (const gate of WORKFLOW_BLOCK_GATES) {
+        gate.assert(workflows, authentication);
+    }
+};
+/** The checks the plugin makes on each server segment route it emits. */
+const SEGMENT_ROUTE_GATES = [
+    {
+        check: 'server-bound-calls',
+        assert: assertServerBoundCallParameters,
+        collect: findBrowserBoundCallParameters,
+    },
+];
+/** The checks the plugin makes as it emits one server segment route: throws the first refusal. */
+export const assertSegmentRouteGates = (segment, trust, options) => {
+    for (const gate of SEGMENT_ROUTE_GATES) {
+        gate.assert(segment, trust, options);
+    }
+};
+const serverSegmentRoutes = (owner, graph, protection) => {
+    const segments = splitIntoSegments(graph);
+    const segmentGraph = {
+        id: owner.ownerId,
+        nodes: graph.nodes || [],
+        edges: graph.edges || [],
+        segments,
+    };
+    return segments
+        .filter((segment) => segment.env === 'server')
+        .map((segment) => ({
+        owner,
+        protection,
+        segment,
+        trust: buildSegmentTrust(segment, segmentGraph),
+    }));
+};
+const isWebhookRoute = (workflow) => !!workflow.trigger &&
+    workflow.trigger.type === 'event-webhook-received' &&
+    !!workflow.webhookConfig;
+/**
+ * The server segment routes, as `workflow-project-plugin` emits them: an
+ * automation runs in the event bus and a cron route on the server, neither
+ * through a segment route; a webhook has its own route (`webhookNeverSends`);
+ * a custom node's graph is split as a workflow started by hand.
+ */
+const collectSegmentRoutes = (workflows) => ownersOf(workflows).flatMap((owner) => {
+    if (owner.ownerKind === 'custom-node') {
+        const customNode = owner.graph;
+        const pseudoWorkflow = {
+            nodes: customNode.nodes || [],
+            edges: customNode.edges || [],
+            trigger: { type: 'manual' },
+        };
+        return serverSegmentRoutes(owner, pseudoWorkflow, customNode.protection);
+    }
+    const workflow = owner.graph;
+    if (isAutomationWorkflow(workflow) ||
+        (workflow.trigger && workflow.trigger.type === 'event-cron-triggered') ||
+        isWebhookRoute(workflow)) {
+        return [];
+    }
+    return serverSegmentRoutes(owner, workflow, workflow.protection);
+});
+const neverSendsOf = (nodes, owner) => nodes
+    .filter((node) => !!node.config && typeof node.config[REFUSE_SEND_KEY] === 'string')
+    .map((node) => ({
+    ownerId: owner.ownerId,
+    ownerKind: owner.ownerKind,
+    nodeId: node.id,
+    message: describeRefusedSend(owner.ownerName, stepNameOf(node), node.config[REFUSE_SEND_KEY]),
+}));
+/** A webhook route's sends, marked as `generateWebhookWorkflowAPIRoute` marks them. */
+const webhookNeverSends = (workflows) => ownersOf(workflows).flatMap((owner) => {
+    const workflow = owner.graph;
+    if (owner.ownerKind !== 'workflow' ||
+        isAutomationWorkflow(workflow) ||
+        !isWebhookRoute(workflow)) {
+        return [];
+    }
+    const serverNodes = (workflow.nodes || []).filter((node) => !CLIENT_ONLY_NODES.has(node.type));
+    const serverNodeIds = new Set(serverNodes.map((node) => node.id));
+    const serverEdges = (workflow.edges || []).filter((edge) => serverNodeIds.has(edge.source) || serverNodeIds.has(edge.target));
+    const marked = markWebhookMessageNodes(workflow, serverNodes, serverEdges, isVerifiedWebhookConfig(workflow.webhookConfig), { silent: true });
+    return neverSendsOf(marked.nodes, owner);
+});
+/**
+ * Every refusal publishing would make over `workflows` (the project's exported
+ * UIDL block, or the part of it a change touches): the gates above, run over a
+ * copy of the block so `workflows` stays as it is, and the routes' sends,
+ * marked without a build-log line. `authentication` is the project's
+ * (`uidl.authentication`): it names the staff roles.
+ */
+export const collectWorkflowPublishRefusals = (workflows, authentication) => {
+    if (!workflows) {
+        return [];
+    }
+    const block = JSON.parse(JSON.stringify(workflows));
+    const refusals = [];
+    for (const gate of WORKFLOW_BLOCK_GATES) {
+        for (const refusal of gate.collect(block, authentication)) {
+            refusals.push(Object.assign({ kind: 'refused', check: gate.check }, refusal));
+        }
+    }
+    const staffRoles = TableAccess.resolveStaffRoles(authentication);
+    for (const route of collectSegmentRoutes(block)) {
+        const options = {
+            owner: route.owner.ownerName,
+            graphNodes: route.owner.graph.nodes || [],
+            protection: route.protection,
+            staffRoles,
+        };
+        for (const gate of SEGMENT_ROUTE_GATES) {
+            for (const found of gate.collect(route.segment, route.trust, options)) {
+                refusals.push({
+                    kind: 'refused',
+                    check: gate.check,
+                    ownerId: route.owner.ownerId,
+                    ownerKind: route.owner.ownerKind,
+                    nodeId: found.nodeId,
+                    message: found.message,
+                });
+            }
+        }
+        const marked = markVisitorBoundMessageNodes(route.segment, route.trust, route.protection, route.owner.ownerName, { silent: true });
+        for (const refusal of neverSendsOf(marked.nodes, route.owner)) {
+            refusals.push(Object.assign({ kind: 'never-sends', check: 'outbound-message' }, refusal));
+        }
+    }
+    for (const refusal of webhookNeverSends(block)) {
+        refusals.push(Object.assign({ kind: 'never-sends', check: 'outbound-message' }, refusal));
+    }
+    return refusals;
+};
+//# sourceMappingURL=publish-refusals.js.map

package/dist/esm/publish-refusals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-refusals.js","sourceRoot":"","sources":["../../src/publish-refusals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAWzD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,uBAAuB,EACvB,eAAe,GAChB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,6BAA6B,EAC7B,wCAAwC,EACxC,6BAA6B,GAC9B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAgB,MAAM,iBAAiB,CAAA;AACjE,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,2BAA2B,CAAA;AAwDlC,MAAM,QAAQ,GAAG,CAAC,SAAwB,EAAW,EAAE,CAAC;IACtD,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC;SACzC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7B,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,IAAI,IAAI,OAAO;QACnC,SAAS,EAAE,UAAmB;QAC9B,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IACL,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC;SAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,OAAO;QACP,SAAS,EAAE,UAAU,CAAC,IAAI,IAAI,OAAO;QACrC,SAAS,EAAE,aAAsB;QACjC,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;CACN,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,KAAY,EAAE,MAAc,EAAU,EAAE;IACxD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,CAAA;IAChG,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,SAAwB,EAAa,EAAE,CAC7D,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;IACpC,IAAI;QACF,wCAAwC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACrD,OAAO,EAAE,CAAA;KACV;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,CAAC,KAAK,YAAY,6BAA6B,CAAC,EAAE;YACrD,MAAM,KAAK,CAAA;SACZ;QACD,OAAO,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,aAAa,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,SAAS,MAC5E,IAAI,6BAA6B,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAChD,EAAE;SACH,CAAC,CAAC,CAAA;KACJ;AACH,CAAC,CAAC,CAAA;AAEJ,MAAM,kBAAkB,GAAG,CAAC,SAAwB,EAAa,EAAE;IACjE,IAAI;QACF,wBAAwB,CAAC,SAAS,CAAC,CAAA;QACnC,OAAO,EAAE,CAAA;KACV;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC,EAAE;YAC5C,MAAM,KAAK,CAAA;SACZ;QACD,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;YACxC,+EAA+E;YAC/E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CACpC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,UAAU,CAC1D,CAAA;YACD,OAAO;gBACL,OAAO,EAAE,SAAS,CAAC,UAAU;gBAC7B,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAE,UAAoB;gBAC1D,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,OAAO,EAAE,aAAa,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,SAChF,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,UACtC,KAAK,SAAS,CAAC,OAAO,6BAA6B;aACpD,CAAA;QACH,CAAC,CAAC,CAAA;KACH;AACH,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CACzB,SAAwB,EACxB,cAA0C,EAC/B,EAAE;IACb,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAChE,OAAO,yBAAyB,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,0BAA0B,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;KAC3D,CAAC,CAAC,CAAA;AACL,CAAC,CAAA;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAC5C,sEAAsE,CAAA;AAExE;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,CAAC,SAAwB,EAAa,EAAE,CACvE,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAE,KAAK,CAAC,KAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7F,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,EAAE;QACtD,OAAO,EAAE,CAAA;KACV;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;SAC7B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,CAAC;SAChE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,aAAa,UAAU,CAAC,IAAI,CAAC,SACpC,KAAK,CAAC,SACR,MAAM,iCAAiC,EAAE;KAC1C,CAAC,CAAC,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAGrD,YAAY,QAAmB;QAC7B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAHpD,SAAI,GAAG,2BAA2B,CAAA;QAIzC,gEAAgE;QAChE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAA;QACnE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAED,MAAM,kCAAkC,GAAG,CAAC,SAAwB,EAAQ,EAAE;IAC5E,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAA;IACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAA;KACjD;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAwB;IAChD,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,cAAc,EAAE;IACpF,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACvF,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,kBAAkB,EAAE;IAC7F;QACE,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,kCAAkC;QAC1C,OAAO,EAAE,wBAAwB;KAClC;CACF,CAAA;AAED,wGAAwG;AACxG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,SAAoC,EACpC,cAA0C,EACpC,EAAE;IACR,IAAI,CAAC,SAAS,EAAE;QACd,OAAM;KACP;IACD,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;KACvC;AACH,CAAC,CAAA;AA4BD,yEAAyE;AACzE,MAAM,mBAAmB,GAAuB;IAC9C;QACE,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,+BAA+B;QACvC,OAAO,EAAE,8BAA8B;KACxC;CACF,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAwB,EACxB,KAA+B,EAC/B,OAAgC,EAC1B,EAAE;IACR,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;KACrC;AACH,CAAC,CAAA;AAUD,MAAM,mBAAmB,GAAG,CAC1B,KAAY,EACZ,KAAmB,EACnB,UAA8C,EAC9B,EAAE;IAClB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,YAAY,GAAG;QACnB,EAAE,EAAE,KAAK,CAAC,OAAO;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,QAAQ;KACT,CAAA;IACD,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC;SAC7C,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjB,KAAK;QACL,UAAU;QACV,OAAO;QACP,KAAK,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC;KAChD,CAAC,CAAC,CAAA;AACP,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,QAAsB,EAAW,EAAE,CACzD,CAAC,CAAC,QAAQ,CAAC,OAAO;IAClB,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,wBAAwB;IAClD,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAA;AAE1B;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,CAAC,SAAwB,EAAkB,EAAE,CACxE,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;IACpC,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,EAAE;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,KAA+B,CAAA;QACxD,MAAM,cAAc,GAAG;YACrB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SACD,CAAA;QAC5B,OAAO,mBAAmB,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;KACzE;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAqB,CAAA;IAC5C,IACE,oBAAoB,CAAC,QAAQ,CAAC;QAC9B,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,sBAAsB,CAAC;QACtE,cAAc,CAAC,QAAQ,CAAC,EACxB;QACA,OAAO,EAAE,CAAA;KACV;IACD,OAAO,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;AAClE,CAAC,CAAC,CAAA;AAEJ,MAAM,YAAY,GAAG,CAAC,KAAyB,EAAE,KAAY,EAAa,EAAE,CAC1E,KAAK;KACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC;KACnF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACd,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,SAAS,EAAE,KAAK,CAAC,SAAS;IAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;IACf,OAAO,EAAE,mBAAmB,CAC1B,KAAK,CAAC,SAAS,EACf,UAAU,CAAC,IAAI,CAAC,EAChB,IAAI,CAAC,MAAM,CAAC,eAAe,CAAW,CACvC;CACF,CAAC,CAAC,CAAA;AAEP,uFAAuF;AACvF,MAAM,iBAAiB,GAAG,CAAC,SAAwB,EAAa,EAAE,CAChE,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAqB,CAAA;IAC5C,IACE,KAAK,CAAC,SAAS,KAAK,UAAU;QAC9B,oBAAoB,CAAC,QAAQ,CAAC;QAC9B,CAAC,cAAc,CAAC,QAAQ,CAAC,EACzB;QACA,OAAO,EAAE,CAAA;KACV;IACD,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/C,CAAC,IAAsB,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9D,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IACjE,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/C,CAAC,IAAsB,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAC7F,CAAA;IACD,MAAM,MAAM,GAAG,uBAAuB,CACpC,QAAQ,EACR,WAAW,EACX,WAAW,EACX,uBAAuB,CAAC,QAAQ,CAAC,aAAkC,CAAC,EACpE,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAA;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAC1C,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,SAAoC,EACpC,cAA0C,EAChB,EAAE;IAC5B,IAAI,CAAC,SAAS,EAAE;QACd,OAAO,EAAE,CAAA;KACV;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAkB,CAAA;IACpE,MAAM,QAAQ,GAA6B,EAAE,CAAA;IAC7C,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE;QACvC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE;YACzD,QAAQ,CAAC,IAAI,iBAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAK,OAAO,EAAG,CAAA;SAClE;KACF;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAChE,KAAK,MAAM,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE;QAC/C,MAAM,OAAO,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAC5B,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YACzC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU;SACX,CAAA;QACD,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE;YACtC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;gBACrE,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;oBAC5B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAA;aACH;SACF;QACD,MAAM,MAAM,GAAG,4BAA4B,CACzC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YAC7D,QAAQ,CAAC,IAAI,iBAAG,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,kBAAkB,IAAK,OAAO,EAAG,CAAA;SAC9E;KACF;IACD,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE;QAC9C,QAAQ,CAAC,IAAI,iBAAG,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,kBAAkB,IAAK,OAAO,EAAG,CAAA;KAC9E;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA"}

package/dist/esm/realtime-generator.d.ts

@@ -1,4 +1,66 @@
-export declare const generateRealtimeServerHelperCode: () => string;
+import { UIDLWorkflows } from '@teleporthq/teleport-types';
+/**
+ * Who a realtime request acts for, and what it may do.
+ *
+ * The site's `/api/realtime/*` routes hold the project's realtime key, so the
+ * realtime worker trusts what they send. They used to forward the browser's
+ * body as it came — `userId`, `senderId`, `senderName` — and the worker gave
+ * every token every channel of the project (`<projectId>:*`): any visitor
+ * subscribed to every channel, joined presence and published as anyone it
+ * named.
+ *
+ * Now the route decides the identity itself, and the browser cannot name one:
+ * - the signed-in user of the site's own session (its id, its name);
+ * - otherwise an opaque per-visitor id, `anon_<hash>`, derived from a random
+ *   key in an httpOnly cookie this route sets. The id is a one-way hash of the
+ *   key, so knowing someone's id (presence shows it) does not let anyone
+ *   present their cookie. On https the cookie is `__Host-tq_rt` (`Path=/`,
+ *   `Secure`, no `Domain`), which a sibling site on the shared hosting domain
+ *   cannot set; plain http (local development) uses `__tq_rt`. Its value is
+ *   `<key>.<HMAC(app secret, key)>`: a value this server did not issue is
+ *   replaced, never adopted, and without the app secret the route refuses.
+ * It sends that identity to the worker in the `x-realtime-identity` header,
+ * and the worker then (real-time-worker `src/lib/identity.ts`):
+ * - uses it as the token's clientId, the presence member and the sender;
+ * - grants a token exactly the channels that identity may use: the channels
+ *   the site's pages subscribe to (`collectSiteRealtimeChannels`), the ones it
+ *   joined, and its own `user.<id>` channel — never `<projectId>:*`;
+ * - keeps `user.<id>` and `user.<id>.<anything>` private to `<id>`: nobody
+ *   else may subscribe, join, list or publish there. Every other channel name
+ *   is public.
+ * Every route is rate-limited per visitor through the shared security runtime.
+ * What Ably vouches for in presence is the member's clientId (that identity);
+ * a member's presence `userName` / `userData` are what its own browser sent
+ * with presence.enter, so they are display data, never proof of who it is.
+ *
+ * The workflow nodes that SEND (`realtime-send-channel-message/event`) run on
+ * the server and call the worker with the key directly; they send as the
+ * author configured, and may address any channel, `user.<id>` included — that
+ * is how a site notifies one user.
+ */
+export declare const REALTIME_IDENTITY_HEADER = "x-realtime-identity";
+export declare const REALTIME_ANON_COOKIE = "__tq_rt";
+export declare const REALTIME_ANON_COOKIE_SECURE = "__Host-tq_rt";
+export declare const REALTIME_MAX_SITE_CHANNELS = 100;
+/** Per-visitor limits of each route, `[limit, windowSeconds]` pairs. */
+export declare const REALTIME_ROUTE_LIMITS: Record<string, Array<[number, number]>>;
+/**
+ * The fixed channel names the site's pages subscribe to (the realtime
+ * triggers). A token is granted these plus whatever the visitor joined; a
+ * name bound to workflow context is not fixed and is granted on join.
+ */
+export declare const collectSiteRealtimeChannels: (workflows: UIDLWorkflows | undefined) => string[];
+/**
+ * Whether a workflow node of the project calls `/api/realtime/<route>` (a
+ * custom-code or HTTP node naming the path). The send nodes do not: they run
+ * on the server and call the realtime worker directly. Without a caller the
+ * browser-facing message / event routes are not emitted — each one is a way
+ * to spend the project's message quota.
+ */
+export declare const projectCallsRealtimeRoute: (workflows: UIDLWorkflows | undefined, route: 'message' | 'event') => boolean;
+export declare const generateRealtimeServerHelperCode: (workflows?: UIDLWorkflows, options?: {
+    withSessionRevocation?: boolean;
+}) => string;
 export declare const generateRealtimeClientCode: () => string;
 export declare const generateRealtimeTokenRoute: () => string;
 export declare const generateRealtimeJoinRoute: () => string;

package/dist/esm/realtime-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime-generator.d.ts","sourceRoot":"","sources":["../../src/realtime-generator.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC,QAAO,MAgBnD,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAO,MAwJ7C,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAO,MAsB7C,CAAA;AAED,eAAO,MAAM,yBAAyB,QAAO,MAsB5C,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAO,MAsB7C,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAO,MAsB/C,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAO,MAsB7C,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAO,MAwBpD,CAAA;AAED,eAAO,MAAM,oCAAoC,QAAO,MA2BvD,CAAA"}
+{"version":3,"file":"realtime-generator.d.ts","sourceRoot":"","sources":["../../src/realtime-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAI1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAA;AAC7D,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAC7C,eAAO,MAAM,2BAA2B,iBAAiB,CAAA;AACzD,eAAO,MAAM,0BAA0B,MAAM,CAAA;AAE7C,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAczE,CAAA;AAID;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,cAAe,aAAa,GAAG,SAAS,KAAG,MAAM,EAsBxF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,cACzB,aAAa,GAAG,SAAS,SAC7B,SAAS,GAAG,OAAO,KACzB,OAiBF,CAAA;AAED,eAAO,MAAM,gCAAgC,eAC/B,aAAa,YAChB;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAE,KAC3C,MA+LF,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAO,MAgK7C,CAAA;AAaD,eAAO,MAAM,0BAA0B,QAAO,MAQ3C,CAAA;AAEH,eAAO,MAAM,yBAAyB,QAAO,MAW1C,CAAA;AAEH,eAAO,MAAM,0BAA0B,QAAO,MAO3C,CAAA;AAEH,eAAO,MAAM,4BAA4B,QAAO,MAS7C,CAAA;AAEH,eAAO,MAAM,0BAA0B,QAAO,MAS3C,CAAA;AAEH,eAAO,MAAM,iCAAiC,QAAO,MAQlD,CAAA;AAEH,eAAO,MAAM,oCAAoC,QAAO,MAUrD,CAAA"}